Use sha256 for CA